John the Ripper is preinstalled in Kali Linux, and its use is pretty straightforward. You can just type john to see its basic use:

john 

If you just use the command and filename as a parameter, John will try to identify the kind of encryption or hashing used in the file, attempt a dictionary attack with its default dictionaries, and then go into brute force mode and try all possible character combinations.

Let's do a dictionary attack using the RockYou wordlist included in Kali Linux. In the latest versions of Kali Linux, this list comes compressed using GZIP; so you will need to decompress it:

cd /usr/share/wordlists/
gunzip rockyou.txt.gz

Now you can run John to crack the collected hashes:

cd ~
john hashes.txt --format=Raw-MD5 
--wordlist=/usr/share/wordlists/rockyou.txt  

Notice the use of the format parameter. As mentioned earlier, John can try to guess the format of the hashes. We already know the hashing algorithm used in DVWA and can take advantage of that knowledge to make the attack more precise.